A switch port is the main entrance into a network and should have adequate security to combat potential threats. A large network could have thousands of access ports distributed across a campus or building. Are all your ports, used and unused, protected from unauthorized access?
When configuring switches, it is recommended that all ports be secured before being deployed for production use in the network. Usually, the unused ports are configured in access mode, placed in an isolated VLAN, and shut down as a security measure. On the contrary, used ports can be secured by implementing the port security feature.
Download the guide and refer back to it at any time!
In this article, we provide the following:
View some of our other security articles:
Port security is a Layer 2 security feature that can be implemented on each port on a switch to filter out incoming frames based on the MAC addresses of the connecting devices. As a result, frames are accepted only from secure MAC addresses, allowing only legitimate devices to access the network, while all other devices are denied.
Port security provides not just a simple MAC address filtering based on which end devices are permitted or denied but also helps control a network's unauthorized expansion. Additionally, it can be a very effective method for protecting against MAC address table flooding attacks.
Port security is not enabled by default on Cisco switches. The feature must be enabled individually on each desired interface since it cannot be enabled globally on the switch.
Once the port security feature is enabled, a maximum of one MAC address is allowed per port, and the port shuts down when a violation occurs. However, the default behavior can be modified, and different criteria can be defined, such as setting up a new limit for maximum MAC addresses, designating specific MAC addresses to be permitted, and changing the violation action.
_________________
We make it easy for you to find the switches that support the port security feature. Click below for hardware options or reach out to us and share the project you are currently working on.
_________________
MAC addresses that are allowed by the port security feature are stored in the secure MAC address table. Depending on how they are learned, some can be saved for use after a reload, while others are discarded. The three types of secure MAC addresses are:
When a frame is received on a switch port with port security enabled, the source MAC address inside the Layer 2 header of the frame is checked against the available MAC addresses in the secure MAC address table. If an entry is matched, the frame is permitted, and the switch continues with the processing. Otherwise, the frame is denied.
As you can see in the image above, port security is enabled on each interface on switch SW1. However, an attacker's PC has been added to interface FastEthernet0/2 instead of an allowed Admin PC. Traffic on interface FastEthernet0/1 is allowed because the MAC address of PC1 is permitted, while everything else is denied on the other two interfaces.
The reason is that the MAC address of the Attacker is not recognized on interface FastEthernet0/2, where only a MAC address of an Admin PC was allowed. Additionally, the number of MAC addresses connected on interface FastEthernet0/3 is higher than the maximum allowance of one, which causes the port to go down.
Each time there is a violation, the switch does not accept the receiving frames. A security violation can happen in several situations, such as:
For each violation, appropriate action is taken on the interface where the port security feature is enabled. Based on the configured violation mode, one of the three available actions can be defined:
_________________
Do you have older switches that are coming up on their end-of-sale date? Roll those right onto our OneCall maintenance strategy, where you get dedicated spares so you can protect your critical infrastructure.
The image below shows an example topology, which will be used to illustrate the configuration of port security on a switch.
The goal is to enable port security on both interfaces on SW1. On interface FastEthernet0/1, only the MAC address of PC1 should be allowed, and the "shutdown" action should be applied in case of a violation.
On interface FastEthernet0/2, a maximum limit of two MAC addresses should be permitted (MAC addresses of the IP phone and PC3), and the violation action of "restrict" should be applied. See the commands below to configure this setup:
To verify that the security feature is configured correctly, use the "show port-security" command for the port security-enabled interfaces. The output below is for interface FastEthernet0/1:
Even though there are several other more advanced features for providing the same level of Layer 2 security, the port security feature is still one of the most commonly applied in networks today. This is mainly due to its simplicity, the benefits it provides without any unexpected behavior, and the lower costs of implementing it.
We know teams can sometimes be stretched thin and don't always have the resources or headcount to configure your gear at the speed you'd like.
PivIT's EXTEND offering can step in to augment your team and remote in to configure your gear with expert-level engineers (SmartHands | EXTEND). If you need someone on-site, we have field services ready at a moment's notice. Get your switches protected today!